skills.rest
adamatdevops
adamatdevopsCOMMUNITY
Explore all skills by this author →
GitHub

sarif-parsing

Parse and normalize OASIS SARIF scan results into filterable security findings.

1|Updated Jan 7, 2026
Search Tags:#static analysis#deduplication#jq#fingerprints#sarif#security findings#ci/cd reporting
One-click install
npx skills add https://github.com/adamatdevops/forge-works --skill sarif-parsing-adamatdevops
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sarif-parsing
Source: https://github.com/adamatdevops/forge-works/tree/main/.skills/trailofbits/sarif-parsing
Command: npx skills add https://github.com/adamatdevops/forge-works --skill sarif-parsing-adamatdevops

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve?

SARIF security scan outputs are difficult to interpret and reuse because findings are deeply nested and often inconsistent across tools and environments, so you need a reliable way to read, filter, aggregate, and transform SARIF into information you can act on.

Core Features & Use Cases

  • SARIF structure understanding: Learn the SARIF 2.1.0 hierarchy (runs, tool driver, results, artifacts) so you can navigate findings confidently.
  • Query and extraction workflows: Use jq and Python helpers to extract rule IDs, severities, messages, file locations, and counts—then reshape results for reporting or CI.
  • Fingerprint-aware deduplication: Use stable fingerprints (or derive stable ones) to deduplicate findings across runs and support regression detection and suppression workflows.
  • Aggregation and conversion: Aggregate multiple SARIF files, summarize severity/rules, and convert SARIF outputs to CSV/HTML-style reports for review.

Quick Start

Use the sarif-parsing skill to extract errors from results.sarif with a single jq query you can run and then interpret as a focused list of high-priority findings.

Frequently Asked Questions about sarif-parsing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I parse SARIF files to extract security findings?▼

Parse SARIF files by normalizing OASIS SARIF 2.1.0 scan results into readable, filterable security findings. Use jq and Python helper utilities to defensively extract rule IDs, severities, messages, and file locations from the nested runs and results structures.

Can I deduplicate SARIF findings across multiple CI/CD runs?▼

Deduplicate SARIF findings across multiple runs using stable fingerprints for cross-environment matching. Derive stable fingerprints when necessary to support regression detection and suppression workflows by identifying repeated security findings.

What is the best way to convert SARIF output for CI/CD reporting?▼

Convert SARIF output for CI/CD reporting by aggregating multiple SARIF files, summarizing severity and rules, and exporting the normalized data into formats suitable for review like CSV or HTML-style reports.

Does this approach support static analysis results from different tools?▼

Static analysis results from different tools are supported through defensive extraction of rule, message, and location fields. This handles inconsistent SARIF outputs across tools and environments by normalizing them into a unified structure.

How do I query specific errors in a SARIF file using jq?▼

Query specific errors in a SARIF file using a single jq command to extract high-priority findings. Navigate the SARIF 2.1.0 hierarchy including runs, tool driver, results, and artifacts to filter by severity or rule ID.

Why are my SARIF security findings difficult to interpret?▼

SARIF security findings are difficult to interpret because they are deeply nested and often inconsistent across tools. Normalizing the OASIS SARIF 2.1.0 structure resolves this by flattening the data into readable, filterable outputs.

Related Skills

Explore More Data & Analytics Skills→
zekiriabdzekiriabd
140

sarif-parsing

Parse SARIF 2.1.0 files to extract, normalize, filter, and compare static analysis findings.

Community
Advanced
roderikroderik
2

sarif-parsing

Parse SARIF 2.1.0 files to extract, deduplicate, and summarize findings.

Community
Basic
dakshrawat298-gifdakshrawat298-gif

sarif-parsing

Parse SARIF files to extract and deduplicate security findings for CI/CD pipelines.

Community
Advanced
vigoliumvigolium
965

sarif-parsing

Convert SARIF static analysis outputs into deduplicated findings for CI/CD gating.

Official
Intermediate